Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
Access (title)Any
Access (analysis)Any
TechniqueCode injection / eval
- Any
- Information disclosure39
- Missing authorisation check33
- Account takeover chain25
- Stored XSS18
- Business logic flaw17
- Leaked secret or key16
- Authentication bypass14
- IDOR / object reference14
- OS command injection13
- Code injection / eval12
- SSRF11
- Reflected XSS10
- Path traversal9
- Unsafe file upload9
- Privilege escalation8
- Request smuggling7
- SQL injection6
- CSRF5
- Denial of service5
- E-mail verification bypass5
- Memory corruption5
- Open redirect5
- Password reset flaw5
- Cache poisoning4
- Session fixation or reuse4
- Dependency confusion / supply chain3
- Local file inclusion3
- OAuth redirect_uri abuse3
- Parameter pollution3
- Race condition3
- SSRF through a redirect3
- Blind XSS2
- Cloud storage misconfiguration2
- CORS misconfiguration2
- CRLF / header injection2
- HTML injection2
- Missing rate limit2
- OAuth state or flow flaw2
- Subdomain takeover2
- Unsafe deserialisation2
- 2FA bypass1
- CSP bypass1
- Deep link abuse1
- DOM XSS1
- postMessage flaw1
- Price or quantity tampering1
- Template injection1
- Weak cryptography1
- XXE1
12 of 15,219 reports · $91,000 in bounties · 161 analysed so far
- #470520ValidAnalysedRCE on Steam Client via buffer overflow in Server InfoValve · Memory Corruption · 2019 · needs: no account · Memory corruption, Code injection / eval–1,289votes
- #873614ValidAnalysedWebsites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' ApplicationPlayStation · Command and Code Injection · 2020 · needs: a user account · Code injection / eval$15,000780votes
- #502758ValidAnalysedRCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Starbucks · Command and Code Injection · 2019 · needs: no account · Path traversal, Unsafe deserialisation, Code injection / eval, Missing authorisation check–572votes
- #783877ValidAnalysedRemote Code Execution in Slack desktop apps + bonusSlack · Command and Code Injection · 2020 · needs: a user account · Code injection / eval, Open redirect, Stored XSS–509votes
- #1154542ValidAnalysedRCE when removing metadata with ExifToolGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval, Unsafe file upload$20,000508votes
- #231460ValidAnalysedOpen prod Jenkins instanceSnapchat · Information Disclosure · 2017 · needs: a user account · Missing authorisation check, Information disclosure, Leaked secret or key, Code injection / eval$15,000436votes
- #1125425ValidAnalysedRCE via unsafe inline Kramdown options when rendering certain Wiki pagesGitLab · Command and Code Injection · 2021 · needs: a user account · Code injection / eval$20,000427votes
- #631956ValidAnalysedPanorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageValve · Command and Code Injection · 2019 · needs: no account · Stored XSS, Code injection / eval–420votes
- #946409ValidAnalysedRCE on build server via misconfigured pip installYelp · Supply Chain and Malicious Code · 2021 · needs: no account · Code injection / eval, Dependency confusion / supply chain–366votes
- #3782701ValidAnalysedUnauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)Mozilla · Command and Code Injection · 2026 · Critical · needs: no account · Code injection / eval, Missing authorisation check, Leaked secret or key$12,000361votes
- #1007014ValidAnalysedRCE via npm misconfig -- installing internal libraries from the public registryUber · Command and Code Injection · 2021 · needs: no account · Dependency confusion / supply chain, Code injection / eval$9,000325votes
- #397545ValidAnalysedMalformed .BMP file in Counter-Strike 1.6 may cause shellcode injectionValve · Memory Corruption · 2020 · needs: no account · Memory corruption, Code injection / eval–321votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.